D-square-B: Deep Distribution Bound for Natural-looking Adversarial Attack

Abstract

We propose a novel technique that can generate natural-looking adversarial examples by bounding the variations induced for internal activation values in some deep layer(s), through a distribution quantile bound and a polynomial barrier loss function. By bounding model internals instead of individual pixels, our attack admits perturbations closely coupled with the existing features of the original input, allowing the generated examples to be natural-looking while having diverse and often substantial pixel distances from the original input. Enforcing per-neuron distribution quantile bounds allows addressing the non-uniformity of internal activation values. Our evaluation on ImageNet and five different model architecture demonstrates that our attack is quite effective. Compared to the state-of-the-art pixel space attack, semantic attack, and feature space attack, our attack can achieve the same attack success/confidence level while having much more natural-looking adversarial perturbations. These perturbations piggy-back on existing local features and do not have any fixed pixel bounds.

References in corpus (18)

• Ensemble Adversarial Training: Attacks and Defenses
• Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networks
• ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Models
• Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examples
• Certified Adversarial Robustness via Randomized Smoothing
• Certified Defenses against Adversarial Examples
• Large Scale Adversarial Representation Learning
• Deep k-Nearest Neighbors: Towards Confident, Interpretable and Robust Deep Learning
• Formal Security Analysis of Neural Networks using Symbolic Intervals
• Keeping the Bad Guys Out: Protecting and Vaccinating Deep Learning with JPEG Compression
• Rethinking Softmax Cross-Entropy Loss for Adversarial Robustness
• Functional Adversarial Attacks
• Unrestricted Adversarial Examples via Semantic Manipulation
• A New Defense Against Adversarial Images: Turning a Weakness into a Strength
• On Certifying Robustness against Backdoor Attacks via Randomized Smoothing
• Certified Robustness for Top-k Predictions against Adversarial Perturbations via Randomized Smoothing
• Harnessing the Vulnerability of Latent Layers in Adversarially Trained Models
• Towards Feature Space Adversarial Attack